瀏覽代碼

Escape any custom CSS to avoid problems with quotes or newlines

Rich 6 年之前
父節點
當前提交
f24db13426
共有 2 個文件被更改,包括 6 次插入2 次删除
  1. 3
    1
      autoHeightWebView/index.android.js
  2. 3
    1
      autoHeightWebView/index.ios.js

+ 3
- 1
autoHeightWebView/index.android.js 查看文件

@@ -240,9 +240,11 @@ export default class AutoHeightWebView extends PureComponent {
240 240
     if (!styles) {
241 241
       return script;
242 242
     }
243
+    // Escape any single quotes or newlines in the CSS with .replace()
244
+    const escaped = styles.replace(/\'/g, "\\'").replace(/\n/g, '\\n')
243 245
     return `
244 246
       var styleElement = document.createElement('style');
245
-      var styleText = document.createTextNode('${styles}');
247
+      var styleText = document.createTextNode('${escaped}');
246 248
       styleElement.appendChild(styleText);
247 249
       document.head.appendChild(styleElement);
248 250
       ${script}

+ 3
- 1
autoHeightWebView/index.ios.js 查看文件

@@ -94,9 +94,11 @@ export default class AutoHeightWebView extends PureComponent {
94 94
       if (!styles) {
95 95
         return script;
96 96
       }
97
+      // Escape any single quotes or newlines in the CSS with .replace()
98
+      const escaped = styles.replace(/\'/g, "\\'").replace(/\n/g, '\\n')
97 99
       return `
98 100
         var styleElement = document.createElement('style');
99
-        var styleText = document.createTextNode('${styles}');
101
+        var styleText = document.createTextNode('${escaped}');
100 102
         styleElement.appendChild(styleText);
101 103
         document.head.appendChild(styleElement);
102 104
         ${script}